VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly handle input leading to a code injection vulnerability. An authenticated actor may be able to send malicious traffic to VMware Cloud Director which may lead to arbitrary remote code execution. This vulnerability can be exploited through the HTML5- and Flex-based UIs, the API Explorer interface and API access.
This indicates an attack attempt to exploit an Expression Language Injection Vulnerability in VMware Cloud Director.This vulnerability is due to insufficient handling of HTTP request. Successful exploitation results in the execution of arbitrary code on the target system.
VMware Cloud Director 10.0.x prior to 10.0.0.2
VMware Cloud Director 9.7.0.x prior to 9.7.0.5
VMware Cloud Director 9.5.0.x prior to 9.5.0.6
VMware Cloud Director 9.1.0.x prior to 9.1.0.4
System Compromise: Remote attackers can gain control of vulnerable systems.
Applied latest upgrade or patch from the vendor:
https://www.vmware.com/security/advisories/VMSA-2020-0010.html
| CVE Infomation | Exploits or more Infomation |
|---|---|
| mitre | EXPLOIT DATABASE |
| NVD | 0day.today |
| vulmon.com | github |
| CVE Details | |
| JVN ENG JPN |
Software Tag:
List of frequently cited URLs
List of frequently cited URLs
| URL | Num of Times Referred to |
|---|---|
| www.sesin.at | 7371 |
| newsbythehour.org | 31 |
| lists.astaro.com | 23 |
| wp.me | 8 |
| canyoupwn.me | 7 |
| www.helpnetsecurity.com | 6 |
| securityboulevard.com | 6 |
| securityaffairs.co | 5 |
| github.com | 4 |
| thehackernews.com | 4 |
| www.vmware.com | 3 |
| twitter.com | 3 |
| anthonyspiteri.net | 3 |
| ipssignatures.appspot.com | 3 |
| citadelo.com | 3 |
| www.youtube.com | 3 |
| Name | URL |
|---|---|
| aaronsvk/CVE-2020-3956 | https://github.com/aaronsvk/CVE-2020-3956 |
| Name | URL |
|---|---|
| aaronsvk/CVE-2020-3956 | github.com |